chawdamrunal/Assay AI dev-stack security scan
Scan a Claude Code plugin, MCP server, hook, or directory for AI-dev-stack security threats. Emits SARIF for GitHub code scanning and can fail the job on risky verdicts.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to scan (a plugin / MCP dir, or the repo root). | no | . |
| fail-on | Threshold that fails the job: unsafe | caution | any | off. | no | unsafe |
| mode | "quick" runs the deterministic pre-pass + SCA/poison floor only (no LLM, no secret required — instant CI gate). "full" runs the LLM-driven 5-stage audit and requires anthropic-api-key (CI has no Claude Code subscription session, so the API-key legacy lane is used). | no | quick |
| anthropic-api-key | Anthropic API key, required only for mode=full. Pass via secrets. | no | "" |
| version | Assay release tag to install (e.g. v0.1.0), or "latest". | no | latest |
| upload-sarif | Upload audit.sarif to GitHub code scanning (mode=full only). | no | true |
Outputs
no outputs